The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The instructions in SKILL.md (Step 3: Verify the claim) direct the agent to "reproduce it from the reporter's steps" for bugs and "run the relevant tests or commands" for pull requests. This is a high-risk pattern that executes code provided by external, untrusted contributors.
[COMMAND_EXECUTION]: The skill requires the agent to execute shell commands, tests, and reproduction scripts derived from untrusted issue reports and PR diffs.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a large attack surface for indirect injection as it ingests untrusted data that could influence its execution flow.
Ingestion points: External GitHub issue and pull request content, including titles, bodies, comments, and code diffs (SKILL.md, Step 1).
Boundary markers: The skill does not define boundary markers or provide instructions to ignore potentially malicious instructions embedded within the ingested issue/PR data.
Capability inventory: The agent has capabilities for command execution, test running (SKILL.md, Step 3), and file system writes (SKILL.md, Step 5 and OUT-OF-SCOPE.md).
Sanitization: There is no evidence of sanitization, validation, or escaping of the external content before it enters the agent's context or is used to trigger commands.

triage